Overview

overview

10

Static

static

950a2d9a7a...18.exe

windows7-x64

8

950a2d9a7a...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    950a2d9a7a0f39f9ab008c76c96e9fc8a93a0eefa5031d0aa01453657df07c18

  • Size

    35.9MB

  • Sample

    220720-gx7mmaceg9

  • MD5

    1aa9acffe0e10bbb240e0dfa07936d38

  • SHA1

    f0624cc7588dd3d8cb0a5f618afa518097aabb69

  • SHA256

    950a2d9a7a0f39f9ab008c76c96e9fc8a93a0eefa5031d0aa01453657df07c18

  • SHA512

    cd89eb5ab041a81f77f015b13485010b105704fc04125177c7045c950a4c40759a1f5359ec2e1f590bb8ee493e7b7f04e84f362c232953de6bbb32a386841b55

Score
10/10
echelonspywarestealer

Malware Config

Targets

    • Target

      950a2d9a7a0f39f9ab008c76c96e9fc8a93a0eefa5031d0aa01453657df07c18

    • Size

      35.9MB

    • MD5

      1aa9acffe0e10bbb240e0dfa07936d38

    • SHA1

      f0624cc7588dd3d8cb0a5f618afa518097aabb69

    • SHA256

      950a2d9a7a0f39f9ab008c76c96e9fc8a93a0eefa5031d0aa01453657df07c18

    • SHA512

      cd89eb5ab041a81f77f015b13485010b105704fc04125177c7045c950a4c40759a1f5359ec2e1f590bb8ee493e7b7f04e84f362c232953de6bbb32a386841b55

    Score
    10/10
    spywarestealerechelon

    • Echelon

      Echelon is a .NET stealer that targets passwords from browsers, email and cryptocurrency clients.

      stealerspywareechelon

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks